F5 patches three NGINX memory flaws rated CVSS 9.2

What happened

F5 published three NGINX security advisories on 14 October 2026. They cover CVE-2026-97205, CVE-2026-93479 and CVE-2026-15176. All three are memory safety bugs in the NGINX worker process.

nginx.org released NGINX Open Source 1.31.7 (mainline) and 1.30.6 (stable) the same day. Those releases also fix two other CVEs, CVE-2026-95101 and CVE-2026-97629, which this article does not cover.

Who is affected

All three flaws affect NGINX Plus and NGINX Open Source. Each one needs a specific configuration:

• CVE-2026-97205: asynchronous file I/O (AIO) enabled, with an SSI page using include virtual commands.
• CVE-2026-93479: a map directive with regex matching whose captures are used by root or a log format before the map output.
• CVE-2026-15176: a location using alias with rewrite, where the request_filename variable is used in set, return or a log format.

On the Plus side, 37.1.0, 37.0.x before 37.0.5.1 and R33 to R36 are affected. On the Open Source side, F5 lists 1.31.x before 1.31.7 and 1.30.x before 1.30.6. nginx.org says older Open Source branches are also vulnerable for two of the CVEs. F5 does not evaluate versions past end of support.

What is confirmed

F5 scores each flaw CVSS 4.0 9.2 (Critical) and CVSS 3.1 8.1 (High). nginx.org rates each one medium. NVD shows the F5 scores and is still awaiting analysis.

F5 says an unauthenticated attacker can send crafted HTTP requests to crash a worker process. Code execution is possible when ASLR is disabled or can be bypassed. F5 says these are data plane issues with no control plane exposure.

CVE-2026-97205 is a use-after-free (CWE-416). The other two are heap buffer overflows (CWE-122). F5 credits Cyberlanc3r for CVE-2026-97205. It credits Matt Suiche of Tolmo, Inc. and Mateusz Gierblinski for CVE-2026-93479. F5 found CVE-2026-15176 itself.

Fixed versions are Open Source 1.31.7 and 1.30.6, and Plus 37.1.0.1 and 37.0.5.1. None of the three CVEs is in the CISA KEV catalog.

What is not confirmed

ThreatWire found no report of exploitation in the wild and no public PoC for any of the three CVEs. F5 lists no fix for NGINX Plus R33 to R36.

F5's rating and nginx.org's rating differ sharply. Neither source explains the gap. ThreatWire found no established news outlet coverage at the time of writing.

What to do

Update NGINX Open Source to 1.31.7 or 1.30.6. Update NGINX Plus to 37.1.0.1 or 37.0.5.1. Plus customers on R33 to R36 should move to a supported release.

If you cannot update yet, check whether your configuration matches any of the three patterns above. Check F5's advisories for any workarounds. Keep ASLR enabled on NGINX hosts.

Sources: F5 advisories K000162608, K000162607 and K000162416, nginx.org security advisories and changelogs, and NVD. Links are in the references list.